How to Extract Hidden Data and Telemetry from Android via Clean ADB

When I get my hands on a test device with a flaky bug or suspicious behavior, the standard Android Studio Logcat window often falls short. I want to quickly take a system snapshot: which accounts are linked, how many times the phone has rebooted, what's running in background services, and how battery was consumed.

Most people in such cases immediately look for root rights or download heavy GUI utilities. In reality, the standard Android Debug Bridge (ADB) can output huge amounts of data without third-party software. The AndroidForensics project by developer Douglas Fresh Habian collects all these commands into a single reference guide and two ready-made Bash scripts.

What's Inside the Repository

Essentially, the repository is a cheat sheet and automation script set for forensics and deep diagnostics of Android devices. The project focuses on working with devices without root rights, although some low-level commands will reveal more on engineering builds.

The repository contains two main executable files:

1. extract.sh — primary triage and user data collection script. It extracts system properties, network configuration, lists of installed packages, active services, and attempts to read content providers.
2. dumpsys.sh — system telemetry collector. The script queries over two dozen internal Android subsystems via the dumpsys utility and organizes logs into separate text files.

Each run creates a separate folder with a timestamp, where results from each individual command are neatly stored. This eliminates terminal clutter and helps immediately capture the system state at a specific point in time.

Useful Commands to Add to Your Arsenal

The README includes both basic getprop calls and non-obvious one-liners with output parsing via grep, sed, and awk.

Collecting Account and Email Address Data

Through the account manager, you can quickly find out which services the phone is linked to and gather all registered email addresses:

adb shell dumpsys account | grep -i com.*$ -o | cut -d' ' -f1 | cut -d} -f1 | grep -v com$

For searching email addresses, the author suggests a regex directly on the system dump:

adb shell dumpsys | grep -E -o "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b"

This command is useful when you need to quickly check whether a previous tester forgot to log out of work accounts on a shared test bench.

Reboot Counter and System Timeline

Sometimes a bug only reproduces after a cold restart, but the user claims the phone was never turned off. You can verify this through global settings:

adb shell settings list global | grep "boot_count=" | cut -d= -f2 | head -n 1 | xargs echo "Booted:" | sed 's/$/ times/g'

And if you need to understand the overall picture of resource consumption and app activity over time, the statistics commands come to the rescue:

adb shell dumpsys usagestats
adb shell dumpsys batterystats
adb shell settings list system

Accessing Content Providers

To extract contacts, call history, and messages, the script makes direct queries to system URIs:

# Список контактов и номеров телефонов
adb shell content query --uri content://contacts/phones/ --projection display_name:number

# Журнал звонков
adb shell content query --uri content://call_log/calls

# База входящих и исходящих SMS
adb shell content query --uri content://sms/

Here's an important technical limitation. Starting with Android 11, Google significantly tightened the security model. On newer OS versions, directly querying content://sms/ or contacts via ADB without special permissions or root will result in an access error. However, on older test devices (Android 9–10) or custom developer builds, these commands continue to work reliably.

How the Automation Works

If running commands manually gets tedious, scripts automate the routine. To get started, just clone the repository and grant execution permissions:

git clone https://github.com/DouglasFreshHabian/AndroidForensics.git
cd AndroidForensics
chmod +x extract.sh dumpsys.sh

When ./extract.sh is launched, the script first checks for installed adb, pings connected devices, and starts collection.

During operation, extract.sh performs several parallel tasks:

• Creates a directory named ADB_Report_20251025_163200.
• Queries device properties (ro.product.model, ro.build.version.release, ro.serialno).
• Takes a snapshot of the last lines of the system log via adb logcat -d.
• In the background, starts generating a full report adb bugreport without blocking the terminal.
• Upon completion, outputs a colored summary table with sizes of all saved files.

The second script, dumpsys.sh, is focused exclusively on diagnosing system services. It sequentially queries meminfo, wifi, power, location, sensorservice, netstats, and 15 more services, saving each output to wifi.txt, meminfo.txt, and so on. If a service is unavailable, the script marks it as crashed and continues operation.

Where This Comes in Handy in Practice

The project has several obvious areas of application:

• QA and mobile app testing. The dumpsys.sh script helps collect a complete device state context in a couple of seconds before filing a complex bug report on memory leaks or power consumption.
• Device audit before handover. If a pool of test devices circulates around the team, it's useful to quickly run a cleanup and verification script to ensure no one else's accounts or heavy background processes remain on the smartphone.
• Initial incident triage. Security specialists get a quick way to capture a smartphone state dump without installing dubious APKs and without making unnecessary changes to the file system.

AndroidForensics doesn't try to reinvent the wheel or replace full-fledged forensic packages like Autopsy. The repository's strength lies elsewhere — it takes standard Android command-line utilities, packages them into a readable format, and saves time on manually writing bash pipelines.

If you regularly connect Android smartphones to your computer for debugging, testing, or security analysis, add these scripts to your local toolkit. They launch in seconds and often find things that slip through during a quick glance at the GUI.